Side-channel based DNN architecture stealing has been reported in several prior works [1]}, [2]}. Even without access to the service, an outsider can extract the DNN architecture through side-channel information leakage, as shown in fig:fig1.
Specifically, when the owner of the neural network IP hosts the application on a third-party cloud computing platform or on a local device with GPU support, it opens it up to architecture stealing through side-channel attacks [3]}, [4]}, [1]}, [2]}. A typical architecture stealing flow consists of profiling the target device, training sequence predictor (e.g., LSTM [7]}), predicting layer sequence based on run-time trace of the target DNN model and then extracting the dimension parameters of each layer.
This is quite different from stealing through Machine-Learning-as-a-Service (MLaaS)  [8]}, [9]}, where the attacker has access to the public prediction API and the confidence score of the labels.
<FIGURE>